Deterministic Agent Permission Analysis

Analyze agent permissions before they become effective authority.

Apply deterministic security rules to agent and tool configurations. Identify broad scopes, missing approval requirements, unsafe runtime identities, destructive actions, external effects, and excessive agency before those capabilities become part of a production workflow.

Analyze Agent Permissions Explore Agent Authority Review

DO YOUR AGENTS HAVE TOO MUCH PERMISSION?

Deterministic permission rules

Apply explicit rules across scope, approval, side effect, runtime identity, reversibility, and external-action categories.

Structured configuration input

Analyze MCP definitions, function schemas, agent configurations, workflow tools, or normalized Workbench tool capsules.

OWASP LLM06 coverage

Map relevant findings to excessive-agency risk without treating framework mapping as proof of control effectiveness.

No LLM calls

Use deterministic rules for repeatable configuration analysis. This surface does not claim observed runtime behavior.

Load example:

{
  "id": "unsafe-email-agent",
  "name": "Autonomous Email Agent",
  "agentType": "sales_agent",
  "description": "Sends email to any recipient without approval.",
  "owner": "Sales Ops",
  "executionIdentity": "service_account",
  "tools": [
    {
      "id": "email-send",
      "name": "Send Email",
      "toolType": "email",
      "description": "Sends email to any recipient.",
      "requiresApproval": false,
      "executionIdentity": "service_account",
      "permissions": [
        {
          "id": "email-write",
          "permissionType": "send_email",
          "scopeLevel": "external",
          "resource": "any_recipient"
        }
      ],
      "actions": [
        {
          "id": "send",
          "name": "Send",
          "actionType": "send_email",
          "sideEffecting": true,
          "requiresApproval": false,
          "riskLevel": "high"
        }
      ],
      "sideEffects": [
        {
          "id": "external-email",
          "sideEffectType": "external_email",
          "external": true,
          "reversible": false,
          "requiresApproval": false
        }
      ]
    }
  ]
}

How Agent Permission Analysis fits

Agent Permission Analysis evaluates individual configurations. Tool Analyzer normalizes tool capabilities and side effects. Authority Graph models how those capabilities compose across a workflow. Agent Authority Review compares intended authority with effective capability and produces the hardening backlog.

AI SECURITY WORKBENCH

Ready to review one representative agent configuration?

Analyze a representative agent and its tools to identify excessive scope, missing approvals, unsafe identities, dangerous side effects, and the questions that require wider Authority Graph analysis.

Scope an AI Security Review See the full Workbench

Continue through the Workbench

Tool Analyzer

Normalize callable capabilities, authentication, permissions, and side effects.

Explore

Continue through the Workbench

Authority Graph

Model how agent and tool authority composes across the workflow.

Explore

Continue through the Workbench

Agent Authority Review

Turn permission and authority findings into a hardening plan.